CVE-2026-104798

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public mcs GET parameter is reflected into post content unsanitized before WordPress core's do shortcode filter runs, allowing an unauthenticated attacker to inject a nested [my calendar above=...] shortcode; mc generate calendar nav() then splits the above attribute on commas and dispatches each element via call user func() with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode $params array is passed to edit user() — which PHP coerces to integer 1 as the $user id argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated /my-calendar/ page, which is publicly accessible by default upon plugin activation.